December 2003 - cypherpunks-legacy

STOP Bad Breath Causing BACTERIA!!!
by biqa＠uspacmall.com 17 Dec '03

17 Dec '03

====================================================== We honor all remove requests; reply with REMOVE in the subject. ====================================================== EXPERIENCE!!! AN INCREDIBLY FRESH, CLEAN, SWEET AND ODOR FREE BREATH!!! ================================== KISS YOUR BAD BREATH GOODBYE NOW AND FOREVER!!! ================================== Also ELIMINATE the bitter taste and foul odor of MORNING BREATH!!! IMAGINE YOUR BREATH.....so CLEAN, FRESH, KISSING SWEET and ODOR FREE that you are EAGER to approach people anytime, anywhere with the FULLEST CONFIDENCE! AT LAST!!! An immediate, effective, tangible, economical and permanent SOLUTION for the CLEANEST, FRESHEST, SWEETEST AND ODOR-FREE BREATH you've ever experienced... ========================================== WHEN SWEET BREATH MEANS EVERYTHING!!! ========================================== For more about the causes and instant cures of bad breath, latest medical research, and the NEW and INCREDIBLY EFFECTIVE Oral Hygiene product, BAD BREATH TERMINATOR, visit our FULL-COLOR ANIMATED WEB SITE now at: http://www.uspacmall.com/breath ================================= If this site is busy, email us at uspac(a)uspacmall.com for the location of our other web site. OR SCROLL DOWN FOR MORE INFO... ======================= HOW IS YOUR BREATH? ======================= --> Do you shy away from meeting people because of your breath? --> Do you experience isolation and a diminished quality of life? --> Does bad breath still persist even after you've tried every known breath spray, breath mint, mouthwash or internal capsule on the market? Bad breath is no joke to those who have it. In fact, it can be a source of EMBARRASSMENT and SHAME. ================= THE GOOD NEWS ================= Doctors and Dentists used to believe the source of bad breath was the digestive system. Research has shown this is SIMPLY NOT TRUE! Actually, the good news about bad breath is that -- in 9 out of 10 cases -- it originates in the mouth, and this type of bad breath is CURABLE! AT LAST!!! One of life's more embarrassing problems has THE PERFECT SOLUTION!!! ========================================== INTRODUCING THE BAD BREATH TERMINATOR: THE PERFECT SOLUTION!!! ========================================== IMMEDIATE...cleans bad breath away completely STARTING FROM YOUR VERY FIRST USE! EFFECTIVE....completely different from any spray, mouthwash or capsule because it doesn't cover your breath, IT EFFECTIVELY ELIMINATES THE VERY SOURCE OF YOUR BAD BREATH!!! * It effectively SCRAPES AWAY and terminates the offensive FOUL ODOR generating EVIL BACTERIA, the coating of WHITE PLAQUE and DECAYING FOOD PARTICLES from the ridges and valleys on the back of the tongue. * YOU MAY NEVER HAVE BAD BREATH AGAIN!!! ECONOMICAL...use it over and over. Lasts for months. NOTHING MORE TO BUY! It COSTS you ONLY $9.98 per set of 2! PERMANENT...use daily as part of your regular oral care for CONTINUOUS FRESH, CLEAN BREATH ALL DAY! This NEW and INCREDIBLY EFFECTIVE Oral Hygiene Product, BAD BREATH TERMINATOR provides an Immediate, Effective, Tangible, Economical and Permanent SOLUTION for the CLEANEST, FRESHEST, SWEETEST breath you've ever experienced!!! ========================================================== For more about the causes and instant cures of bad breath, latest medical research, and the Incredible BAD BREATH TERMINATOR, visit our FULL-COLOR ANIMATED WEB SITE NOW at: http://www.uspacmall.com/breath ================================= If this site is busy, email us at uspac(a)uspacmall.com for the location of our other web site. Thank you for your time. Susan #

1 0

Import restrictions for crypto code
by Jerry R. Brady 17 Dec '03

17 Dec '03

First, I was at hip, met some of you, camped behind the cypherpunks tent and had a blast. I'm not on the list anymore (couldn't keep up) but have a quick question which I know someone can post a quick answer back to me directly. I'd appreciate it. We have an RC540/RSA512/MD5 crypto package our customers use for the secure exchange of CAD data files with some of the automotive industry OEMs - It is a very lucrative store-and-forward system. We have a customer in Italy and I need to know if there are any import restrictions for sending the software there. We already have a GSN exemption because the international code is whimpy. Perhaps there is also an on-line resource that covers what countries have import restrictions? Any help would be appreciated, please mail directly to me. Regards, Jerry ps. Lucky - what became of the "Brain"? -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Jerry R. Brady jrb(a)autoweb.net Technical Director (v) 248.967.3738 AutoWeb Communications, Inc. (f) 248.967.3739 -=- PGP5 key at pgpkeys.mit.edu or via e-mail -=-

1 0

Re: FCPUNX:PGP Key Escrow and Congress
by Eli Brandt 17 Dec '03

17 Dec '03

Bruce Schneier wrote: > From: "Barbara Simons" <simons(a)VNET.IBM.COM> > > Some of these are old arguments that we've been hearing for a while, > but some are newer. In particular, points 4 and 6 are difficult to > refute without getting into some technical details. Both points also > undercut the argument that a key recovery infrastructure potentially > weakens security. After all, the NSA thinks it's secure enough that it > can be used by the government. Non-technical point: the NSA (reportedly) has no intention of using GAK for classified information. They know that it weakens security. Do the privacy of the nation's data and the security of its information infrastructure deserve the same consideration as the Pentagon's "Confidential" memos? When you're planning to build in a single point of failure, this is a question you have to ask. -- Eli Brandt | eli+(a)cs.cmu.edu | http://www.cs.cmu.edu/~eli/

5 4

Left Brain / Right Brain QUESTIONAIRE
by stargazer＠force2.net 17 Dec '03

17 Dec '03

_________________________________________________ L E F T B R A I N / R I G H T B R A I N - QUESTIONAIRE _________________________________________________ My name is Gregory Raymond and I believe you are someone who is interested in a successful lifestyle. By this I mean a balance of physical, mental, spiritual and financial success. If we are of a like mind, I thought you might be interested in taking the following brief, revealing quiz. Simply [hit reply] then place an "X" in the appropriate boxes where applicable, and send it to us. I know and understand there are two parts to my mind, conscious and sub-conscious (aka unconscious) Yes [ ] - No [ ] - Maybe [ ] - Didn't Know [ ] I know the sub-conscious part of my mind labors 24 hours a day (without sleeping) for my success or failure, without making any moral judgements. Yes [ ] - No [ ] - Maybe [ ] - Didn't Know [ ] I realize that by taking control of my subconscious mind, it's energy can be harnessed to accomplish whatever I desire. Yes [ ] - No [ ] - Maybe [ ] - Didn't Know [ ] I might be interested learning more about using my subconscious mind to attain a successful balance of physical, mental, and financial success. Yes [ ] - No [ ] - Maybe [ ] [ ] You have piqued my curiosity, and without any obligation, I would like to learn more about achieving mental, physical and financial success. [ ] I'm not interested in this ridiculous survey, and with my CONSCIOUS MIND, I think that you're "Full Of It". Take me off your list and never darken my E-Door again. Thank you for your time. Regards, Gregory Raymond P.S. You may visit our site at: http://www.savoynet.com/carrmond/esoteric/master.htm to check on survey stats, they are updated after each mailing.

1 0

Re: what can we do about PGP sell out and CMR?
by Anonymous 17 Dec '03

17 Dec '03

You've got a lot of nerve accusing PGP, Inc. of being "sellouts" when you're over on open-pgp pushing KEY ESCROW, of all things. I can see it now, the new product name, "PGP with Key Escrow". Motto: "Lose your key? Don't worry, we've got a copy." Do you really think cypherpunks are going to support key escrow? Fat chance.

2 1

Re: Security flaws introduced by "other readers" in CMR
by Anonymous 17 Dec '03

17 Dec '03

Let's look a little closer at the kinds of access and notice available in the PGP system compared to alternatives. As several people have pointed out, no encryption system can provide protection against what is done with the message after it is decrypted. The receiver could share it with whoever he wants to, or whoever he is forced to. Consider the following scenarios: - An encrypted message is sent to someone at his workplace using current systems like PGP 2.6. - An encrypted message is sent to someone at his workplace, who is using the message access features of PGP 5.5. The corporation key is marked as "optional", and the message is not encrypted to that extra key. - An encrypted message is sent as before, but this time the message is encrypted to the corporate key. - An encrypted message is sent to someone at his workplace, who is using a different form of corporate access which relies on key escrow or automatic acquisition of cleartext. We agree that none of these systems can provide complete protection against third party access. In any of them, the receiver could be forced to turn over the encrypted message. But there is still a difference. In the first two scenarios, the expectation of privacy is the same. You are encrypting to a personal key at a business address, but you expect that you would know about it if the data were being provided to a third party. There is no widespread installed base of software which provides secret access after the message is decrypted. In fact, the second scenario arguably provides slightly more privacy than the first, which is what we have now. The reason is that in the second scenario, the company provides an optional mechanism for business mail to be recoverable, but also provides an explicit, sender-controlled escape clause. The company is granting an explicit expectation of privacy by allowing the corporate key recipient to be removed. With usage of older versions of PGP, there was really no way for the company to even inform the sender about whether it was going to be reading the mail. In the third scenario, where you encrypt to the corporate key, there is no expectation of privacy. All parties, the sender, the receiver, and the company, know that the data is being made available to the business. There is not much privacy here; what you have is business security. This mode would be used for business documents and business communications. In the fourth scenario, which some people are offering as a superior approach, the expectation of privacy is much less clear. Unlike in the current PGP approach, where the design of the corporate access system is oriented around notifying the sender and receiver, a key escrow or plaintext recovery system inherently provides no such notice. This is different from the status quo. We are talking about a commercial product which provides automatic corporate access to communications. Widespread installation and use of this alternate version of PGP inherently changes the assumptions and expectations that you will have when you encrypt to someone at work. Given the company's desire for message access, this approach implies that you must conservatively assume that most encryption to a business address will be read. The PGP system is designed to avoid this. It provides another method for corporate access, a visible and explicit method. It is intended as an alternative to key escrow and other systems which recovery data after the recipient gets it. PGP's third party recipient feature is designed to prevent the creation of an installed base of escrowed keys and after the fact third party access software. Even if the encryption system provides a way for the user to mark his keys as being escrowed or otherwise providing third party access, the system is not self-correcting in the way the PGP system is. It would be much easier for a business owner to pervert a secretive access system than one like PGP. The company could install the access features but not tell its employees that their keys were being escrowed, or that their mail client was secretly storing a copy of all plaintexts. This kind of change would be easy to make with the after-the-fact access systems some people are proposing. Yes, theoretically this can be done with any encryption system (as all agree) but the point is to avoid the widespread distribution of software which invites this kind of abuse. The PGP system is designed to satisfy business needs without leading us into this dangerous situation. A world in which third party encryption by the sender is the normal and widespread method for corporate access is one with increased privacy and more visibility of access. The alternatives which have been proposed are prone to abuse and provide less visibility. They lead us towards a world in which there is no expectation of privacy even for encrypted messages, by providing an installed base of snooping software. The PGP approach is explicitly designed to keep us out of that world, by removing the need for that kind of software.

3 2

pro-crypto govt. people
by Stanton McCandlish 17 Dec '03

17 Dec '03

This year I recall seeing 1 former prosecutor saying that widespread encryption was good and/or that GAK was bad, and 1 military or former military person of fairly high status saying that GAK was bad. Circa 1994-5 I also recall a military or retired miltiary person of rank reporting that very widespread crypto would be a boost to national security. We could really use these people's, and similar people's, words in pro-crypto efforts. Unfortunately, disk problems a while back cost me most of my old mail, including all of these saved items. If anyone has them and/or knows who these people are, please let me know. -- Stanton McCandlish mech(a)eff.org Electronic Frontier Foundation Program Director http://www.eff.org/~mech +1 415 436 9333 x105 (v), +1 415 436 9333 (f) Are YOU an EFF member? http://www.eff.org/join

6 5

Non-conventional
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May implied that Cpunx should develop non-conventional email. Crypto has been declared to be munitions. Nukes are non-conventional weapons. Should we be developing nuclear email? Should we 'email-nuke DC?" Prespiring minds want to know...

3 2

Request for expert opinion and Feedback
by Joubin 17 Dec '03

17 Dec '03

Hello all, I am involved in a project which aims at the creation of a free and portable Java(tm) based object operating system. A basic functional requirement for this new OS is to provide /fast and effective/ strong cryptographic support at the OS level. The basic structure of the system is a layered architecture, with the lowest layer consisting of a platform specific (non-portable) kernel supporting an embedded JVM (again in C/ASM) and a set of Java(tm) interfaces to this 'virtual platform'. The OS proper will sit on top of this and will be 100% Java (tm). The issue: As you may know, SMI has and will deliver a set of 'security' packages as a standard component of JDK. This uses RSA technology. Basic and general 'interfaces' to encapsulate constructs such as Key, Provider, Cypher, etc. are also defined. A few people in the project group feel that many different groups and entities out there will provide (portable) Public Key encryption packages (implemented in Java(tm)) that can be used by the users of the OS. They argue against embedding computational support at the Kernel (non-portable) layer as wasted effort. Others (& myself included) feel that 'effective' also means efficiency of execution. Specially so if such functionality is to be used to encypher 'streams' and such (if that is possible). Your expert advice: a) How do you feel about 'where' the computational support should be implemented ? b) Assuming answer to (a) to be "At the kernel level and in C/ASM", is it possible to achieve a fine-grain modularity in terms of fairly generic algorithms and computations which can then be combined in conjunction to support a variety of encryption strategies ? c) Is there any benefit to implementing the random number generation system in the Kernel? Your input is greatly appreciated. If you feel there are other considerations to be made, please let me know. Thank you. Joubin p.s. Java(tm) and related items are the tightly guarded property of Sun Microsystems Inc. __________________________________ member, alpha zero LLC joubin(a)inch.com NoVA __________________________________

1 0

Re: Spoofing
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

semprini(a)theschool.com wrote: > > I don't think I'm out of line here in saying that all this spoofing of > other users is a bit childish. I'm sure there are better > things one could find to do with one's time. (Possibly work on > cracking RSA's 128- bit key?) > > --Dylan I already cracked it. The message is: "Sorry, but we ran out of cash."

1 0